Authentication · interview question
How does a server verify the integrity of a JWT when using HMAC SHA-256?
Multiple choiceHardchapter-17-curatedpremiumauthenticationjwt-signatures
Answer and explanation
Correct answer
C. By re-calculating the signature and matching it with the received one.
Why
The server re-calculates the signature using the Header, Payload, and a secret key, then compares it with the signature received. If they match, the data integrity is confirmed; otherwise, the token is considered tampered with.
Test yourself on Authentication
A free test with instant, explained results. No account needed.
More Authentication questions
- In the context of JWT, what is the primary purpose of the signature?
- How can a Java developer verify the signature of a JWT using HMAC SHA-256?
- How would you explain a significant consequence of using stateless JWT tokens for authentication in an interview?
- Which statement about JWT payloads is correct?
- Which statement best describes the use of CSRF tokens in web applications?
- Why is using BCrypt preferable over a fast hashing algorithm like SHA-256 for password hashing?